I don't think the argument is that they shouldn't be prosecuted for hacking the CIA, as much as that the CIA should also be prosecuted for having such shit secu

I don't think the argument is that they shouldn't be prosecuted for hacking the CIA, as much as that the CIA should also be prosecuted for having such shit security on important data. Personally I don't think drafting a new law for that is a good idea, but I can see how it could fall under gross negligence.